Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
39628f6572e6bf8683a71f66014933a5
-
SHA1
b4641f32159cb0de61e077566e027707b8429569
-
SHA256
046fa33ef56688e34c5aa9dbaf8b673cbec5fbc2712196674403dfafd9f700ef
-
SHA512
56c30c2f86d7b08aae9bd96e93e7305a2c26b90749fd7110315ff86370a2dd0f3352be1b2b1e715d6cbdb6d9364016dacdbcf9b1d18b7c5ce523d2dfa3b34e70
-
SSDEEP
24576:I4KxV8f6044+c12Ny3tMDI0l+GjMZijmcpjjjjQnOjWLghlKh6w34kcCSC9Bzv85:6E9euqNScU+vPtSRotkDWef/Dbyp
Malware Config
Extracted
orcus
192.168.1.135:2410
7fa2f818413f42a2990b40d91a249534
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 5 IoCs
resource yara_rule behavioral1/memory/1968-15-0x0000000000400000-0x00000000004E8000-memory.dmp orcus behavioral1/memory/1968-17-0x0000000000400000-0x00000000004E8000-memory.dmp orcus behavioral1/memory/1968-13-0x0000000000400000-0x00000000004E8000-memory.dmp orcus behavioral1/memory/1968-10-0x0000000000400000-0x00000000004E8000-memory.dmp orcus behavioral1/memory/1968-9-0x0000000000400000-0x00000000004E8000-memory.dmp orcus -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemManager = "C:\\Users\\Admin\\SystemManager.exe" 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1072 set thread context of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1968 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe Token: SeDebugPrivilege 1968 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1968 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1988 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 28 PID 1072 wrote to memory of 1988 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 28 PID 1072 wrote to memory of 1988 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 28 PID 1072 wrote to memory of 1988 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 28 PID 1072 wrote to memory of 1988 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 28 PID 1072 wrote to memory of 1988 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 28 PID 1072 wrote to memory of 1988 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 28 PID 1072 wrote to memory of 852 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 29 PID 1072 wrote to memory of 852 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 29 PID 1072 wrote to memory of 852 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 29 PID 1072 wrote to memory of 852 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 29 PID 1072 wrote to memory of 852 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 29 PID 1072 wrote to memory of 852 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 29 PID 1072 wrote to memory of 852 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 29 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30 PID 1072 wrote to memory of 1968 1072 39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1988
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:852
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1968
-